reusable cspell, claude pr reviews, link issues and prs

[kernelsam]

Issue number: senzing-factory/build-resources#232 senzing-factory/build-resources#227 senzing-factory/build-resources#10

---

Resolves senzing-factory/build-resources#232
Resolves senzing-factory/build-resources#227
Resolves senzing-factory/build-resources#10

[github-actions]

🤖 Claude Code Review

PR Code Review

Code Quality

✅ Code follows style guide - The YAML files follow proper GitHub Actions syntax and structure. Consistent indentation (2 spaces) and proper formatting throughout.

✅ No commented-out code - All three modified files contain only active configuration with one intentional inline comment explaining the conditional logic.

✅ Meaningful variable names - Job names (review, link-issues, spellcheck) and workflow names are clear and descriptive.

✅ DRY principle followed - This PR improves DRY compliance by extracting the spellcheck implementation to a reusable workflow at .github/workflows/spellcheck.yaml:13, reducing duplication.

✅ Identify Defects - No bugs, logic errors, or security vulnerabilities detected. The workflows are well-structured with proper:

• Permissions scoping (following principle of least privilege)
• Concurrency control in .github/workflows/claude-pr-review.yaml:3-5 to prevent redundant runs
• Conditional execution in .github/workflows/link-issues-to-pr-post-merge.yaml:12 to only run on merged PRs

Testing

❌ Unit tests for new functions - N/A - These are GitHub Actions workflow configurations, not application code. GitHub Actions don't have unit tests in the traditional sense.

❌ Integration tests for new endpoints - N/A - No application endpoints added.

❌ Edge cases covered - N/A for workflow files, though the workflows themselves handle edge cases (cancel-in-progress, merged vs closed).

❌ Test coverage > 80% - N/A - Workflow files are not tested with coverage metrics.

Note: Testing section is not applicable to GitHub Actions workflow configurations.

Documentation

✅ Readme updated if needed - No README update needed. The workflows are self-documenting and don't change user-facing functionality.

✅ API docs updated - N/A - No API changes.

✅ Inline comments for complex logic - Good inline comment at .github/workflows/link-issues-to-pr-post-merge.yaml:11 explaining the conditional: # Only run if PR was actually merged (not just closed)

❌ CHANGELOG.md updated - The CHANGELOG.md at line 10 shows - (empty unreleased section). This PR should add an entry describing the new workflows:

## [Unreleased]

### Added in Unreleased

- Add Claude PR review automation workflow
- Add workflow to link issues to PRs post-merge  
- Refactor spellcheck to use reusable workflow

Security

✅ No hardcoded credentials - Secret properly referenced via ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} at .github/workflows/claude-pr-review.yaml:20

✅ Input validation implemented - GitHub Actions handles this. Proper use of github.event.pull_request.merged boolean check.

✅ Proper error handling - Workflows will fail gracefully if reusable workflows are unavailable.

✅ No sensitive data in logs - No sensitive information logged.

🚨 CRITICAL: License file detected - File testdata/senzing-license/g2.lic exists and appears to contain binary/encoded license data. While this appears to be in a test data directory and may be intentional, it should be reviewed to ensure:

1. It's meant to be committed
2. It doesn't contain production credentials
3. The grep results show "AQAAAD" strings in build-resources/.vscode/cspell.json and build-resources/claude/pr-prompt.md - these appear to be in documentation/config files mentioning the pattern itself (not actual license strings), which is acceptable.

Additional Observations

Positive aspects:

1. Excellent use of reusable workflows from senzing-factory/build-resources, promoting consistency across repositories
2. Proper permission scoping following least-privilege principle
3. Concurrency control prevents wasted CI resources
4. Clean refactoring of spellcheck workflow reduces maintenance burden

Areas for improvement:

1. Update CHANGELOG.md to document these workflow additions
2. Verify the .lic file in testdata is intentional (appears to be for testing purposes based on path)

Summary

This is a well-structured PR that adds useful automation and improves code reusability. The main issue is the missing CHANGELOG entry. The license file in testdata appears intentional for testing but should be confirmed.

Automated code review analyzing defects and coding standards